Article 5*

Article 5 – Distinction between different categories of data subjects

Commission proposal

1. Member States shall provide that, as far as possible, the controller makes a clear distinction between personal data of different categories of data subjects, such as:

(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;

(b) persons convicted of a criminal offence;

(c) victims of a criminal offence, or persons with regard to whom certain facts give reasons for believing that he or she could be the victim of a criminal offence;

(d) third parties to the criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, or a person who can provide information on criminal offences, or a contact or associate to one of the persons mentioned in (a) and (b); and

(e) persons who do not fall within any of the categories referred to above.

EDRi’s proposed amendment

1. Member States shall provide that, as far as possible, the controller makes a clear distinction between personal data of different categories of data subjects, such as:

(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;

(b) persons convicted of a criminal offence;

(c) victims of a criminal offence, or persons with regard to whom certain facts give reasons for believing that he or she could be the victim of a criminal offence;

(d) third parties to the criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings;

(e), or a persons who can provide information on criminal offences;

(f), or a contacts or associates to one of the persons mentioned in (a) and (b); and

(g)(e) persons who do not fall within any of the categories referred to above.

1a. Member States shall provide specific rules on the consequences of this categorisation, taking into account the different purposes for which data are collected. These specific rules shall include conditions for collecting data, time limits for retention, possible limitations to data subject’s rights of access and information and the modalities of access to data by competent authorities.

Justification

The obligation to distinguish between the different categories of data subjects should be absolute. Given that law enforcement authorities need a specified purpose when collecting data, they should always be able to give a prima facie opinion in which category they belong. If there are doubts, the “other” category can be used (and adjusted over time). It should also be considered to add a category of specifically “non-suspected persons”, see EDPS opinion, pts. 349 to 354. Additionally, point (d) could be split into several points – it makes a difference whether one is a witness of a crime or an associate of a (suspected) criminal. This would mirror wording in the Europol Decision, Article 14.

As the EDPS stated, the consequences of these categorisations should also be spelled out, especially as regards data subject rights – restrictions on the right of access for suspects can be justified more easily than for witnesses, for example.